ANAC ISCR Theoretical Exam (AVSEC Security Screening Instructor) cheat sheet

Brazil's civil aviation security framework derives from Lei 7.565/1986 (Código Brasileiro de Aeronáutica), which authorizes the regulator to issue aviation security rules.

ANAC issues AVSEC requirements through RBAC (Regulamento Brasileiro da Aviação Civil) series regulations, notably RBAC 107 for airport and operator security programs and RBAC 108 for screening personnel certification.

The National Civil Aviation Security Program (PNAVSEC) is issued at the national level under the authority of the Comitê Nacional de Segurança da Aviação Civil (CONAVSEC); operator programs must be consistent with it.

Compliance chain: PNAVSEC → airport security program (PSA) → operator/company security program → local procedures and training records.

RBAC 108 governs certification and recurrent qualification of security screening personnel, including theoretical and practical examination requirements.

Oversight is executed through audits, inspections, and surveillance by ANAC; non-compliance can trigger sanctions under Lei 7.565/1986 and RBAC enforcement provisions.

Regulatory hierarchy: law → decree → RBAC regulation → resolution/instruction → approved security program → operational procedure.

Records of training, certification, and recurrency must be retained and made available to the regulator on request; retention periods are set in the applicable RBAC.

Annex 17 to the Chicago Convention contains Standards (binding, 'shall') and Recommended Practices ('should'); States notify differences to ICAO.

Annex 17 obliges each State to establish a National Civil Aviation Security Program, a national appropriate authority, and a national security committee.

Annex 17 requires each Contracting State to designate an appropriate authority and to ensure operators and airports have security programs approved by that authority.

Doc 8973 (Aviation Security Manual) is ICAO guidance, not a Standard; it explains how to implement Annex 17 provisions.

Annex 17 requires screening of passengers and cabin baggage, protection of hold baggage from unauthorized interference, and cargo/mail security controls.

The Convention on Offences and Certain Other Acts Committed on Board Aircraft (Tokyo 1963), Hague 1970, and Montreal 1971/1988 define the legal treatment of unlawful interference.

Annex 17 requires States to establish a process for sharing threat information and to conduct security risk assessments for their operations.

ICAO Universal Security Audit Programme (USAP) evaluates State implementation of Annex 17 Standards and the related Annex 9 and Annex 11 provisions.

Threat assessment combines intent, capability, and opportunity; risk = threat × vulnerability × consequence.

Threat levels are commonly expressed as low, medium, high, and critical, and drive corresponding increments in screening and patrol measures.

Sources of threat intelligence include national intelligence services, police, airport operators, airlines, and international partners via the appropriate authority.

Indicators of intent include hostile reconnaissance, unusual questioning, altered documents, and behavior inconsistent with the travel context.

Vulnerability analysis identifies gaps in access control, screening, and response capability that an adversary could exploit.

Consequence analysis weighs loss of life, aircraft damage, operational disruption, and reputational and economic impact.

A threat assessment is a living product: it must be reviewed when intelligence changes, when major infrastructure changes, and at defined intervals.

Risk treatment options are: avoid, reduce (mitigate), transfer, or accept; acceptance must be documented and approved at the appropriate level.

Unlawful interference includes unlawful seizure of aircraft, sabotage, hostage-taking, unlawful entry to airside areas, and introduction of weapons or dangerous devices.

The unlawful interference response cycle is: prevent, detect, respond, and recover, with notification obligations to the appropriate authority.

A security risk register records each identified risk with likelihood, impact, existing controls, residual rating, and an accountable owner.

The ALARP principle (as low as reasonably practicable) is applied when deciding whether further mitigation is justified.

Insider threat controls include vetting, background checks, segregation of duties, and monitoring of access to security-restricted areas.

A bomb threat or specific threat triggers predefined escalation, search, evacuation, and coordination procedures with police and the operator.

Post-incident activity includes preservation of evidence, reporting to the appropriate authority, and revision of the risk assessment.

Security risk management is iterative; controls are validated through drills, exercises, and audits rather than assumed effective.

Key roles: airport operator security manager, screening organization supervisor, airline security officer, and the State appropriate authority.

The Airport Security Committee coordinates security matters among the operator, airlines, police, and service providers and meets at defined intervals.

The security program defines restricted area boundaries, screening points, and the responsibilities of each entity operating at the airport.

Security responsibilities are documented in contracts and service-level agreements with ground handlers and concessionaires.

Contingency plans cover bomb threats, hijacking, sabotage, and facility failure, and are tested through tabletop and live exercises.

Security awareness training is required for all airport staff with airside access, not only for screening personnel.

Supervisors must verify that screening positions are staffed, qualified, and rotated in accordance with fatigue and performance rules.

Reporting lines must ensure security-relevant information reaches the security manager and, where required, the appropriate authority without delay.

Access control layers are: perimeter, airside boundary, security-restricted area, and critical parts of restricted areas.

Identity and authorization checks require a valid airport identification card plus, where applicable, a personal identification document.

Electronic access control uses card, PIN, or biometric factors; cards must be revoked immediately on loss, theft, or termination.

The one-person-one-card rule prohibits tailgating and piggybacking; anti-passback logic detects credential sharing.

Perimeter protection combines physical barriers, intrusion detection, CCTV, lighting, and patrols; each layer compensates for the weaknesses of others.

Access points to restricted areas must be controlled, alarmed where unattended, and monitored from a staffed control room.

Vehicle access requires separate control, inspection, and escort procedures for vehicles entering the airside.

Screening of persons and items entering restricted areas is applied where the risk assessment identifies an insider or intrusion threat.

Screening sequence: document and boarding pass check, divesting, X-ray of cabin baggage, walk-through metal detection or body scanner, and resolution of alarms.

Divesting rules separate electronics, liquids, and metallic items; jackets and outer garments are screened separately.

Liquids, aerosols, and gels are subject to volume and container limits set in the national program; exceptions exist for essential medicines and baby food with verification.

Alarm resolution follows a defined escalation: re-screen, targeted search, and finally a full hand search of the item.

Hand search must be conducted in the passenger's presence with consent to the search of the item, and with a witness where required.

Prohibited items detected are handled under a documented procedure: refusal to surrender, police notification, and incident reporting.

Screening personnel must not accept gifts or favors from passengers and must avoid any conflict of interest in the screening decision.

Special categories (crew, diplomats, persons with reduced mobility) follow defined procedures but are never exempt from the security outcome.

Hold baggage must be protected from unauthorized interference from the point of screening to loading on the aircraft.

Reconciliation ensures each checked bag is matched to a passenger who has boarded; unattended or unidentified bags are not loaded.

Hold baggage screening uses EDS (explosive detection systems) or multi-view X-ray with a defined alarm resolution protocol.

Known consignor and regulated agent concepts allow cargo to be secured upstream, with the chain of custody documented.

Cargo screening methods include X-ray, explosive trace detection, physical search, and use of trained detection dogs.

Mail security requires screening of all mail carried on passenger and cargo aircraft, with procedures for suspicious items.

Chain-of-custody documentation must identify who screened the item, when, by what method, and the result.

Access to hold baggage and cargo storage areas is restricted and monitored; seals and tamper-evident devices are checked before loading.

X-ray image interpretation relies on density and atomic number: organic materials appear orange, inorganic/metals blue or black, and mixed materials green.

Multi-view and CT-based systems generate 3D images that reduce the need for manual search but require specific interpretation training.

Metal detectors are tested with a defined test piece before each shift and after any interruption; results are recorded.

EDS equipment must pass daily and periodic verification tests using approved test pieces; failures trigger removal from service.

Equipment maintenance is performed by qualified technicians under a maintenance schedule; operators record faults and do not use defective equipment.

Image interpretation training uses a library of threat and non-threat images with increasing complexity and time pressure.

Operator performance is monitored through threat image projection (TIP) and regular competency checks.

Radiation safety rules apply to X-ray equipment: no access to the beam, interlocks verified, and leakage surveys performed by qualified personnel.

Prohibited items are categorized as weapons, explosives, incendiaries, and other dangerous devices or substances defined in the national program.

Recognition relies on shape, density, component parts, and context, not on a single visual cue.

Improvised explosive devices may show batteries, wiring, switches, or unusual packing; any such combination is treated as a threat until resolved.

Disguised items (e.g., belt buckle knives, pen guns, concealed blades) require training on component-based recognition.

On detection, the operator must not touch or move a suspected explosive device; the area is cleared and the bomb squad is notified.

Items surrendered are documented and handed to the appropriate authority according to the national procedure.

Weapons detected on a passenger trigger police notification and an incident report; the passenger is not permitted to board with the item.

Prohibited item lists are updated by the appropriate authority and must be reflected in training materials and signage.

A lesson plan specifies objectives, prerequisites, content sequence, methods, materials, timing, and assessment criteria.

Learning objectives should be written with observable action verbs and measurable conditions (e.g., 'identify three prohibited items in a 30-second image').

Instructional methods include lecture, demonstration, guided practice, simulation, and on-the-job training, selected by objective type.

The demonstration–practice–feedback cycle is the core of psychomotor skills training such as hand search and image interpretation.

Questioning technique should use open questions to check understanding and closed questions to confirm facts.

Feedback must be specific, timely, and behavior-focused; it describes what was observed and what to change.

Presentation aids support, not replace, the instructor; each aid should serve a stated objective.

Instructor talk time should be balanced with learner activity; the ratio is set by the lesson design, not by habit.

Adult learners bring experience and expect relevance; instruction must connect to the job task and its consequences.

Knowles' andragogy principles: need to know, self-concept, prior experience, readiness to learn, orientation to problem-solving, and motivation.

Bloom's taxonomy levels (remember, understand, apply, analyze, evaluate, create) guide the choice of assessment method.

Assessment validity means the test measures the intended objective; reliability means consistent results across occasions and raters.

Formative assessment occurs during training to guide learning; summative assessment occurs at the end to certify competence.

A test blueprint maps each objective to items and weights, ensuring coverage and preventing over-sampling of easy topics.

Item quality checks include clarity, single correct answer, plausible distractors, and avoidance of cueing or trick wording.

Practical assessments use a checklist or rubric with defined critical (pass/fail) items and behavioral anchors.

A training needs analysis identifies the gap between required and current competence, and the tasks that justify training.

Task analysis breaks each job into tasks, sub-tasks, and required knowledge, skills, and attitudes, forming the basis of the curriculum.

The curriculum defines modules, hours, entry requirements, instructors, facilities, and assessment methods for each objective.

Initial training is followed by recurrent training at intervals set by the regulation, with content updated for new threats and equipment.

Competency-based programs define a minimum performance standard and do not advance learners who fail critical items.

Training records must capture trainee identity, content, date, instructor, result, and expiry of the qualification.

Instructor qualification includes subject competence, instructional technique, and assessed delivery before authorization.

Program evaluation uses Kirkpatrick levels: reaction, learning, behavior, and results, with data from tests and operational audits.

Instructor competency domains: subject knowledge, instructional design, delivery, assessment, and professional conduct.

Instructor evaluation includes classroom observation, learner feedback, and review of assessment decisions for consistency.

Inter-rater reliability is protected by calibration sessions in which instructors score the same performance and compare results.

Assessment decisions must be documented with the evidence observed and the standard applied, and be defensible on review.

Instructor recurrency requires periodic re-evaluation of both technical knowledge and instructional skills.

Evaluation data sources include test results, TIP detection rates, incident reports, and audit findings.

A non-conforming assessment (e.g., passing a learner who failed a critical item) is a reportable quality failure requiring corrective action.

Continuous improvement loop: collect data, identify gap, design intervention, implement, and re-measure.

Quality assurance of a training program covers content currency, instructor competence, facility suitability, and assessment integrity.

Internal audits of the training organization are scheduled at defined intervals and results are tracked to closure.

Key performance indicators include pass rate, first-attempt failure rate, TIP detection rate, and time-to-resolution of image alarms.

Trend analysis of test items identifies ambiguous or too-easy items, which are revised or retired.

Corrective action requires root-cause analysis, an owner, a deadline, and verification of effectiveness.

Changes to regulations, equipment, or threat level trigger a documented review of training content.

Learner complaints and appeals are handled under a defined procedure with records retained.

Management review uses audit, KPI, and feedback data to confirm the program remains fit for purpose.

Brazil's civil aviation security framework derives from Lei 7.565/1986 (Código Brasileiro de Aeronáutica), which authorizes the regulator to issue aviation security rules.

ANAC issues AVSEC requirements through RBAC (Regulamento Brasileiro da Aviação Civil) series regulations, notably RBAC 107 for airport and operator security programs and RBAC 108 for screening personnel certification.

The National Civil Aviation Security Program (PNAVSEC) is issued at the national level under the authority of the Comitê Nacional de Segurança da Aviação Civil (CONAVSEC); operator programs must be consistent with it.

Compliance chain: PNAVSEC → airport security program (PSA) → operator/company security program → local procedures and training records.

RBAC 108 governs certification and recurrent qualification of security screening personnel, including theoretical and practical examination requirements.

Oversight is executed through audits, inspections, and surveillance by ANAC; non-compliance can trigger sanctions under Lei 7.565/1986 and RBAC enforcement provisions.

Regulatory hierarchy: law → decree → RBAC regulation → resolution/instruction → approved security program → operational procedure.

Records of training, certification, and recurrency must be retained and made available to the regulator on request; retention periods are set in the applicable RBAC.

Annex 17 to the Chicago Convention contains Standards (binding, 'shall') and Recommended Practices ('should'); States notify differences to ICAO.

Annex 17 obliges each State to establish a National Civil Aviation Security Program, a national appropriate authority, and a national security committee.

Annex 17 requires each Contracting State to designate an appropriate authority and to ensure operators and airports have security programs approved by that authority.

Doc 8973 (Aviation Security Manual) is ICAO guidance, not a Standard; it explains how to implement Annex 17 provisions.

Annex 17 requires screening of passengers and cabin baggage, protection of hold baggage from unauthorized interference, and cargo/mail security controls.

The Convention on Offences and Certain Other Acts Committed on Board Aircraft (Tokyo 1963), Hague 1970, and Montreal 1971/1988 define the legal treatment of unlawful interference.

Annex 17 requires States to establish a process for sharing threat information and to conduct security risk assessments for their operations.

ICAO Universal Security Audit Programme (USAP) evaluates State implementation of Annex 17 Standards and the related Annex 9 and Annex 11 provisions.

Threat assessment combines intent, capability, and opportunity; risk = threat × vulnerability × consequence.

Threat levels are commonly expressed as low, medium, high, and critical, and drive corresponding increments in screening and patrol measures.

Sources of threat intelligence include national intelligence services, police, airport operators, airlines, and international partners via the appropriate authority.

Indicators of intent include hostile reconnaissance, unusual questioning, altered documents, and behavior inconsistent with the travel context.

Vulnerability analysis identifies gaps in access control, screening, and response capability that an adversary could exploit.

Consequence analysis weighs loss of life, aircraft damage, operational disruption, and reputational and economic impact.

A threat assessment is a living product: it must be reviewed when intelligence changes, when major infrastructure changes, and at defined intervals.

Risk treatment options are: avoid, reduce (mitigate), transfer, or accept; acceptance must be documented and approved at the appropriate level.

Unlawful interference includes unlawful seizure of aircraft, sabotage, hostage-taking, unlawful entry to airside areas, and introduction of weapons or dangerous devices.

The unlawful interference response cycle is: prevent, detect, respond, and recover, with notification obligations to the appropriate authority.

A security risk register records each identified risk with likelihood, impact, existing controls, residual rating, and an accountable owner.

The ALARP principle (as low as reasonably practicable) is applied when deciding whether further mitigation is justified.

Insider threat controls include vetting, background checks, segregation of duties, and monitoring of access to security-restricted areas.

A bomb threat or specific threat triggers predefined escalation, search, evacuation, and coordination procedures with police and the operator.

Post-incident activity includes preservation of evidence, reporting to the appropriate authority, and revision of the risk assessment.

Security risk management is iterative; controls are validated through drills, exercises, and audits rather than assumed effective.

Key roles: airport operator security manager, screening organization supervisor, airline security officer, and the State appropriate authority.

The Airport Security Committee coordinates security matters among the operator, airlines, police, and service providers and meets at defined intervals.

The security program defines restricted area boundaries, screening points, and the responsibilities of each entity operating at the airport.

Security responsibilities are documented in contracts and service-level agreements with ground handlers and concessionaires.

Contingency plans cover bomb threats, hijacking, sabotage, and facility failure, and are tested through tabletop and live exercises.

Security awareness training is required for all airport staff with airside access, not only for screening personnel.

Supervisors must verify that screening positions are staffed, qualified, and rotated in accordance with fatigue and performance rules.

Reporting lines must ensure security-relevant information reaches the security manager and, where required, the appropriate authority without delay.

Access control layers are: perimeter, airside boundary, security-restricted area, and critical parts of restricted areas.

Identity and authorization checks require a valid airport identification card plus, where applicable, a personal identification document.

Electronic access control uses card, PIN, or biometric factors; cards must be revoked immediately on loss, theft, or termination.

The one-person-one-card rule prohibits tailgating and piggybacking; anti-passback logic detects credential sharing.

Perimeter protection combines physical barriers, intrusion detection, CCTV, lighting, and patrols; each layer compensates for the weaknesses of others.

Access points to restricted areas must be controlled, alarmed where unattended, and monitored from a staffed control room.

Vehicle access requires separate control, inspection, and escort procedures for vehicles entering the airside.

Screening of persons and items entering restricted areas is applied where the risk assessment identifies an insider or intrusion threat.

Screening sequence: document and boarding pass check, divesting, X-ray of cabin baggage, walk-through metal detection or body scanner, and resolution of alarms.

Divesting rules separate electronics, liquids, and metallic items; jackets and outer garments are screened separately.

Liquids, aerosols, and gels are subject to volume and container limits set in the national program; exceptions exist for essential medicines and baby food with verification.

Alarm resolution follows a defined escalation: re-screen, targeted search, and finally a full hand search of the item.

Hand search must be conducted in the passenger's presence with consent to the search of the item, and with a witness where required.

Prohibited items detected are handled under a documented procedure: refusal to surrender, police notification, and incident reporting.

Screening personnel must not accept gifts or favors from passengers and must avoid any conflict of interest in the screening decision.

Special categories (crew, diplomats, persons with reduced mobility) follow defined procedures but are never exempt from the security outcome.

Hold baggage must be protected from unauthorized interference from the point of screening to loading on the aircraft.

Reconciliation ensures each checked bag is matched to a passenger who has boarded; unattended or unidentified bags are not loaded.

Hold baggage screening uses EDS (explosive detection systems) or multi-view X-ray with a defined alarm resolution protocol.

Known consignor and regulated agent concepts allow cargo to be secured upstream, with the chain of custody documented.

Cargo screening methods include X-ray, explosive trace detection, physical search, and use of trained detection dogs.

Mail security requires screening of all mail carried on passenger and cargo aircraft, with procedures for suspicious items.

Chain-of-custody documentation must identify who screened the item, when, by what method, and the result.

Access to hold baggage and cargo storage areas is restricted and monitored; seals and tamper-evident devices are checked before loading.

X-ray image interpretation relies on density and atomic number: organic materials appear orange, inorganic/metals blue or black, and mixed materials green.

Multi-view and CT-based systems generate 3D images that reduce the need for manual search but require specific interpretation training.

Metal detectors are tested with a defined test piece before each shift and after any interruption; results are recorded.

EDS equipment must pass daily and periodic verification tests using approved test pieces; failures trigger removal from service.

Equipment maintenance is performed by qualified technicians under a maintenance schedule; operators record faults and do not use defective equipment.

Image interpretation training uses a library of threat and non-threat images with increasing complexity and time pressure.

Operator performance is monitored through threat image projection (TIP) and regular competency checks.

Radiation safety rules apply to X-ray equipment: no access to the beam, interlocks verified, and leakage surveys performed by qualified personnel.

Prohibited items are categorized as weapons, explosives, incendiaries, and other dangerous devices or substances defined in the national program.

Recognition relies on shape, density, component parts, and context, not on a single visual cue.

Improvised explosive devices may show batteries, wiring, switches, or unusual packing; any such combination is treated as a threat until resolved.

Disguised items (e.g., belt buckle knives, pen guns, concealed blades) require training on component-based recognition.

On detection, the operator must not touch or move a suspected explosive device; the area is cleared and the bomb squad is notified.

Items surrendered are documented and handed to the appropriate authority according to the national procedure.

Weapons detected on a passenger trigger police notification and an incident report; the passenger is not permitted to board with the item.

Prohibited item lists are updated by the appropriate authority and must be reflected in training materials and signage.

A lesson plan specifies objectives, prerequisites, content sequence, methods, materials, timing, and assessment criteria.

Learning objectives should be written with observable action verbs and measurable conditions (e.g., 'identify three prohibited items in a 30-second image').

Instructional methods include lecture, demonstration, guided practice, simulation, and on-the-job training, selected by objective type.

The demonstration–practice–feedback cycle is the core of psychomotor skills training such as hand search and image interpretation.

Questioning technique should use open questions to check understanding and closed questions to confirm facts.

Feedback must be specific, timely, and behavior-focused; it describes what was observed and what to change.

Presentation aids support, not replace, the instructor; each aid should serve a stated objective.

Instructor talk time should be balanced with learner activity; the ratio is set by the lesson design, not by habit.

Adult learners bring experience and expect relevance; instruction must connect to the job task and its consequences.

Knowles' andragogy principles: need to know, self-concept, prior experience, readiness to learn, orientation to problem-solving, and motivation.

Bloom's taxonomy levels (remember, understand, apply, analyze, evaluate, create) guide the choice of assessment method.

Assessment validity means the test measures the intended objective; reliability means consistent results across occasions and raters.

Formative assessment occurs during training to guide learning; summative assessment occurs at the end to certify competence.

A test blueprint maps each objective to items and weights, ensuring coverage and preventing over-sampling of easy topics.

Item quality checks include clarity, single correct answer, plausible distractors, and avoidance of cueing or trick wording.

Practical assessments use a checklist or rubric with defined critical (pass/fail) items and behavioral anchors.

A training needs analysis identifies the gap between required and current competence, and the tasks that justify training.

Task analysis breaks each job into tasks, sub-tasks, and required knowledge, skills, and attitudes, forming the basis of the curriculum.

The curriculum defines modules, hours, entry requirements, instructors, facilities, and assessment methods for each objective.

Initial training is followed by recurrent training at intervals set by the regulation, with content updated for new threats and equipment.

Competency-based programs define a minimum performance standard and do not advance learners who fail critical items.

Training records must capture trainee identity, content, date, instructor, result, and expiry of the qualification.

Instructor qualification includes subject competence, instructional technique, and assessed delivery before authorization.

Program evaluation uses Kirkpatrick levels: reaction, learning, behavior, and results, with data from tests and operational audits.

Instructor competency domains: subject knowledge, instructional design, delivery, assessment, and professional conduct.

Instructor evaluation includes classroom observation, learner feedback, and review of assessment decisions for consistency.

Inter-rater reliability is protected by calibration sessions in which instructors score the same performance and compare results.

Assessment decisions must be documented with the evidence observed and the standard applied, and be defensible on review.

Instructor recurrency requires periodic re-evaluation of both technical knowledge and instructional skills.

Evaluation data sources include test results, TIP detection rates, incident reports, and audit findings.

A non-conforming assessment (e.g., passing a learner who failed a critical item) is a reportable quality failure requiring corrective action.

Continuous improvement loop: collect data, identify gap, design intervention, implement, and re-measure.

Quality assurance of a training program covers content currency, instructor competence, facility suitability, and assessment integrity.

Internal audits of the training organization are scheduled at defined intervals and results are tracked to closure.

Key performance indicators include pass rate, first-attempt failure rate, TIP detection rate, and time-to-resolution of image alarms.

Trend analysis of test items identifies ambiguous or too-easy items, which are revised or retired.

Corrective action requires root-cause analysis, an owner, a deadline, and verification of effectiveness.

Changes to regulations, equipment, or threat level trigger a documented review of training content.

Learner complaints and appeals are handled under a defined procedure with records retained.

Management review uses audit, KPI, and feedback data to confirm the program remains fit for purpose.

Brazil's civil aviation security framework derives from Lei 7.565/1986 (Código Brasileiro de Aeronáutica), which authorizes the regulator to issue aviation security rules.

ANAC issues AVSEC requirements through RBAC (Regulamento Brasileiro da Aviação Civil) series regulations, notably RBAC 107 for airport and operator security programs and RBAC 108 for screening personnel certification.

The National Civil Aviation Security Program (PNAVSEC) is issued at the national level under the authority of the Comitê Nacional de Segurança da Aviação Civil (CONAVSEC); operator programs must be consistent with it.

Compliance chain: PNAVSEC → airport security program (PSA) → operator/company security program → local procedures and training records.

RBAC 108 governs certification and recurrent qualification of security screening personnel, including theoretical and practical examination requirements.

Oversight is executed through audits, inspections, and surveillance by ANAC; non-compliance can trigger sanctions under Lei 7.565/1986 and RBAC enforcement provisions.

Regulatory hierarchy: law → decree → RBAC regulation → resolution/instruction → approved security program → operational procedure.

Records of training, certification, and recurrency must be retained and made available to the regulator on request; retention periods are set in the applicable RBAC.

Annex 17 to the Chicago Convention contains Standards (binding, 'shall') and Recommended Practices ('should'); States notify differences to ICAO.

Annex 17 obliges each State to establish a National Civil Aviation Security Program, a national appropriate authority, and a national security committee.

Annex 17 requires each Contracting State to designate an appropriate authority and to ensure operators and airports have security programs approved by that authority.

Doc 8973 (Aviation Security Manual) is ICAO guidance, not a Standard; it explains how to implement Annex 17 provisions.

Annex 17 requires screening of passengers and cabin baggage, protection of hold baggage from unauthorized interference, and cargo/mail security controls.

The Convention on Offences and Certain Other Acts Committed on Board Aircraft (Tokyo 1963), Hague 1970, and Montreal 1971/1988 define the legal treatment of unlawful interference.

Annex 17 requires States to establish a process for sharing threat information and to conduct security risk assessments for their operations.

ICAO Universal Security Audit Programme (USAP) evaluates State implementation of Annex 17 Standards and the related Annex 9 and Annex 11 provisions.

Threat assessment combines intent, capability, and opportunity; risk = threat × vulnerability × consequence.

Threat levels are commonly expressed as low, medium, high, and critical, and drive corresponding increments in screening and patrol measures.

Sources of threat intelligence include national intelligence services, police, airport operators, airlines, and international partners via the appropriate authority.

Indicators of intent include hostile reconnaissance, unusual questioning, altered documents, and behavior inconsistent with the travel context.

Vulnerability analysis identifies gaps in access control, screening, and response capability that an adversary could exploit.

Consequence analysis weighs loss of life, aircraft damage, operational disruption, and reputational and economic impact.

A threat assessment is a living product: it must be reviewed when intelligence changes, when major infrastructure changes, and at defined intervals.

Risk treatment options are: avoid, reduce (mitigate), transfer, or accept; acceptance must be documented and approved at the appropriate level.

Unlawful interference includes unlawful seizure of aircraft, sabotage, hostage-taking, unlawful entry to airside areas, and introduction of weapons or dangerous devices.

The unlawful interference response cycle is: prevent, detect, respond, and recover, with notification obligations to the appropriate authority.

A security risk register records each identified risk with likelihood, impact, existing controls, residual rating, and an accountable owner.

The ALARP principle (as low as reasonably practicable) is applied when deciding whether further mitigation is justified.

Insider threat controls include vetting, background checks, segregation of duties, and monitoring of access to security-restricted areas.

A bomb threat or specific threat triggers predefined escalation, search, evacuation, and coordination procedures with police and the operator.

Post-incident activity includes preservation of evidence, reporting to the appropriate authority, and revision of the risk assessment.

Security risk management is iterative; controls are validated through drills, exercises, and audits rather than assumed effective.

Key roles: airport operator security manager, screening organization supervisor, airline security officer, and the State appropriate authority.

The Airport Security Committee coordinates security matters among the operator, airlines, police, and service providers and meets at defined intervals.

The security program defines restricted area boundaries, screening points, and the responsibilities of each entity operating at the airport.

Security responsibilities are documented in contracts and service-level agreements with ground handlers and concessionaires.

Contingency plans cover bomb threats, hijacking, sabotage, and facility failure, and are tested through tabletop and live exercises.

Security awareness training is required for all airport staff with airside access, not only for screening personnel.

Supervisors must verify that screening positions are staffed, qualified, and rotated in accordance with fatigue and performance rules.

Reporting lines must ensure security-relevant information reaches the security manager and, where required, the appropriate authority without delay.

Access control layers are: perimeter, airside boundary, security-restricted area, and critical parts of restricted areas.

Identity and authorization checks require a valid airport identification card plus, where applicable, a personal identification document.

Electronic access control uses card, PIN, or biometric factors; cards must be revoked immediately on loss, theft, or termination.

The one-person-one-card rule prohibits tailgating and piggybacking; anti-passback logic detects credential sharing.

Perimeter protection combines physical barriers, intrusion detection, CCTV, lighting, and patrols; each layer compensates for the weaknesses of others.

Access points to restricted areas must be controlled, alarmed where unattended, and monitored from a staffed control room.

Vehicle access requires separate control, inspection, and escort procedures for vehicles entering the airside.

Screening of persons and items entering restricted areas is applied where the risk assessment identifies an insider or intrusion threat.

Screening sequence: document and boarding pass check, divesting, X-ray of cabin baggage, walk-through metal detection or body scanner, and resolution of alarms.

Divesting rules separate electronics, liquids, and metallic items; jackets and outer garments are screened separately.

Liquids, aerosols, and gels are subject to volume and container limits set in the national program; exceptions exist for essential medicines and baby food with verification.

Alarm resolution follows a defined escalation: re-screen, targeted search, and finally a full hand search of the item.

Hand search must be conducted in the passenger's presence with consent to the search of the item, and with a witness where required.

Prohibited items detected are handled under a documented procedure: refusal to surrender, police notification, and incident reporting.

Screening personnel must not accept gifts or favors from passengers and must avoid any conflict of interest in the screening decision.

Special categories (crew, diplomats, persons with reduced mobility) follow defined procedures but are never exempt from the security outcome.

Hold baggage must be protected from unauthorized interference from the point of screening to loading on the aircraft.

Reconciliation ensures each checked bag is matched to a passenger who has boarded; unattended or unidentified bags are not loaded.

Hold baggage screening uses EDS (explosive detection systems) or multi-view X-ray with a defined alarm resolution protocol.

Known consignor and regulated agent concepts allow cargo to be secured upstream, with the chain of custody documented.

Cargo screening methods include X-ray, explosive trace detection, physical search, and use of trained detection dogs.

Mail security requires screening of all mail carried on passenger and cargo aircraft, with procedures for suspicious items.

Chain-of-custody documentation must identify who screened the item, when, by what method, and the result.

Access to hold baggage and cargo storage areas is restricted and monitored; seals and tamper-evident devices are checked before loading.

X-ray image interpretation relies on density and atomic number: organic materials appear orange, inorganic/metals blue or black, and mixed materials green.

Multi-view and CT-based systems generate 3D images that reduce the need for manual search but require specific interpretation training.

Metal detectors are tested with a defined test piece before each shift and after any interruption; results are recorded.

EDS equipment must pass daily and periodic verification tests using approved test pieces; failures trigger removal from service.

Equipment maintenance is performed by qualified technicians under a maintenance schedule; operators record faults and do not use defective equipment.

Image interpretation training uses a library of threat and non-threat images with increasing complexity and time pressure.

Operator performance is monitored through threat image projection (TIP) and regular competency checks.

Radiation safety rules apply to X-ray equipment: no access to the beam, interlocks verified, and leakage surveys performed by qualified personnel.

Prohibited items are categorized as weapons, explosives, incendiaries, and other dangerous devices or substances defined in the national program.

Recognition relies on shape, density, component parts, and context, not on a single visual cue.

Improvised explosive devices may show batteries, wiring, switches, or unusual packing; any such combination is treated as a threat until resolved.

Disguised items (e.g., belt buckle knives, pen guns, concealed blades) require training on component-based recognition.

On detection, the operator must not touch or move a suspected explosive device; the area is cleared and the bomb squad is notified.

Items surrendered are documented and handed to the appropriate authority according to the national procedure.

Weapons detected on a passenger trigger police notification and an incident report; the passenger is not permitted to board with the item.

Prohibited item lists are updated by the appropriate authority and must be reflected in training materials and signage.

A lesson plan specifies objectives, prerequisites, content sequence, methods, materials, timing, and assessment criteria.

Learning objectives should be written with observable action verbs and measurable conditions (e.g., 'identify three prohibited items in a 30-second image').

Instructional methods include lecture, demonstration, guided practice, simulation, and on-the-job training, selected by objective type.

The demonstration–practice–feedback cycle is the core of psychomotor skills training such as hand search and image interpretation.

Questioning technique should use open questions to check understanding and closed questions to confirm facts.

Feedback must be specific, timely, and behavior-focused; it describes what was observed and what to change.

Presentation aids support, not replace, the instructor; each aid should serve a stated objective.

Instructor talk time should be balanced with learner activity; the ratio is set by the lesson design, not by habit.

Adult learners bring experience and expect relevance; instruction must connect to the job task and its consequences.

Knowles' andragogy principles: need to know, self-concept, prior experience, readiness to learn, orientation to problem-solving, and motivation.

Bloom's taxonomy levels (remember, understand, apply, analyze, evaluate, create) guide the choice of assessment method.

Assessment validity means the test measures the intended objective; reliability means consistent results across occasions and raters.

Formative assessment occurs during training to guide learning; summative assessment occurs at the end to certify competence.

A test blueprint maps each objective to items and weights, ensuring coverage and preventing over-sampling of easy topics.

Item quality checks include clarity, single correct answer, plausible distractors, and avoidance of cueing or trick wording.

Practical assessments use a checklist or rubric with defined critical (pass/fail) items and behavioral anchors.

A training needs analysis identifies the gap between required and current competence, and the tasks that justify training.

Task analysis breaks each job into tasks, sub-tasks, and required knowledge, skills, and attitudes, forming the basis of the curriculum.

The curriculum defines modules, hours, entry requirements, instructors, facilities, and assessment methods for each objective.

Initial training is followed by recurrent training at intervals set by the regulation, with content updated for new threats and equipment.

Competency-based programs define a minimum performance standard and do not advance learners who fail critical items.

Training records must capture trainee identity, content, date, instructor, result, and expiry of the qualification.

Instructor qualification includes subject competence, instructional technique, and assessed delivery before authorization.

Program evaluation uses Kirkpatrick levels: reaction, learning, behavior, and results, with data from tests and operational audits.

Instructor competency domains: subject knowledge, instructional design, delivery, assessment, and professional conduct.

Instructor evaluation includes classroom observation, learner feedback, and review of assessment decisions for consistency.

Inter-rater reliability is protected by calibration sessions in which instructors score the same performance and compare results.

Assessment decisions must be documented with the evidence observed and the standard applied, and be defensible on review.

Instructor recurrency requires periodic re-evaluation of both technical knowledge and instructional skills.

Evaluation data sources include test results, TIP detection rates, incident reports, and audit findings.

A non-conforming assessment (e.g., passing a learner who failed a critical item) is a reportable quality failure requiring corrective action.

Continuous improvement loop: collect data, identify gap, design intervention, implement, and re-measure.

Quality assurance of a training program covers content currency, instructor competence, facility suitability, and assessment integrity.

Internal audits of the training organization are scheduled at defined intervals and results are tracked to closure.

Key performance indicators include pass rate, first-attempt failure rate, TIP detection rate, and time-to-resolution of image alarms.

Trend analysis of test items identifies ambiguous or too-easy items, which are revised or retired.

Corrective action requires root-cause analysis, an owner, a deadline, and verification of effectiveness.

Changes to regulations, equipment, or threat level trigger a documented review of training content.

Learner complaints and appeals are handled under a defined procedure with records retained.

Management review uses audit, KPI, and feedback data to confirm the program remains fit for purpose.

Brazil's civil aviation security framework derives from Lei 7.565/1986 (Código Brasileiro de Aeronáutica), which authorizes the regulator to issue aviation security rules.

ANAC issues AVSEC requirements through RBAC (Regulamento Brasileiro da Aviação Civil) series regulations, notably RBAC 107 for airport and operator security programs and RBAC 108 for screening personnel certification.

The National Civil Aviation Security Program (PNAVSEC) is issued at the national level under the authority of the Comitê Nacional de Segurança da Aviação Civil (CONAVSEC); operator programs must be consistent with it.

Compliance chain: PNAVSEC → airport security program (PSA) → operator/company security program → local procedures and training records.

RBAC 108 governs certification and recurrent qualification of security screening personnel, including theoretical and practical examination requirements.

Oversight is executed through audits, inspections, and surveillance by ANAC; non-compliance can trigger sanctions under Lei 7.565/1986 and RBAC enforcement provisions.

Regulatory hierarchy: law → decree → RBAC regulation → resolution/instruction → approved security program → operational procedure.

Records of training, certification, and recurrency must be retained and made available to the regulator on request; retention periods are set in the applicable RBAC.

Annex 17 to the Chicago Convention contains Standards (binding, 'shall') and Recommended Practices ('should'); States notify differences to ICAO.

Annex 17 obliges each State to establish a National Civil Aviation Security Program, a national appropriate authority, and a national security committee.

Annex 17 requires each Contracting State to designate an appropriate authority and to ensure operators and airports have security programs approved by that authority.

Doc 8973 (Aviation Security Manual) is ICAO guidance, not a Standard; it explains how to implement Annex 17 provisions.

Annex 17 requires screening of passengers and cabin baggage, protection of hold baggage from unauthorized interference, and cargo/mail security controls.

The Convention on Offences and Certain Other Acts Committed on Board Aircraft (Tokyo 1963), Hague 1970, and Montreal 1971/1988 define the legal treatment of unlawful interference.

Annex 17 requires States to establish a process for sharing threat information and to conduct security risk assessments for their operations.

ICAO Universal Security Audit Programme (USAP) evaluates State implementation of Annex 17 Standards and the related Annex 9 and Annex 11 provisions.

Threat assessment combines intent, capability, and opportunity; risk = threat × vulnerability × consequence.

Threat levels are commonly expressed as low, medium, high, and critical, and drive corresponding increments in screening and patrol measures.

Sources of threat intelligence include national intelligence services, police, airport operators, airlines, and international partners via the appropriate authority.

Indicators of intent include hostile reconnaissance, unusual questioning, altered documents, and behavior inconsistent with the travel context.

Vulnerability analysis identifies gaps in access control, screening, and response capability that an adversary could exploit.

Consequence analysis weighs loss of life, aircraft damage, operational disruption, and reputational and economic impact.

A threat assessment is a living product: it must be reviewed when intelligence changes, when major infrastructure changes, and at defined intervals.

Risk treatment options are: avoid, reduce (mitigate), transfer, or accept; acceptance must be documented and approved at the appropriate level.

Unlawful interference includes unlawful seizure of aircraft, sabotage, hostage-taking, unlawful entry to airside areas, and introduction of weapons or dangerous devices.

The unlawful interference response cycle is: prevent, detect, respond, and recover, with notification obligations to the appropriate authority.

A security risk register records each identified risk with likelihood, impact, existing controls, residual rating, and an accountable owner.

The ALARP principle (as low as reasonably practicable) is applied when deciding whether further mitigation is justified.

Insider threat controls include vetting, background checks, segregation of duties, and monitoring of access to security-restricted areas.

A bomb threat or specific threat triggers predefined escalation, search, evacuation, and coordination procedures with police and the operator.

Post-incident activity includes preservation of evidence, reporting to the appropriate authority, and revision of the risk assessment.

Security risk management is iterative; controls are validated through drills, exercises, and audits rather than assumed effective.

Key roles: airport operator security manager, screening organization supervisor, airline security officer, and the State appropriate authority.

The Airport Security Committee coordinates security matters among the operator, airlines, police, and service providers and meets at defined intervals.

The security program defines restricted area boundaries, screening points, and the responsibilities of each entity operating at the airport.

Security responsibilities are documented in contracts and service-level agreements with ground handlers and concessionaires.

Contingency plans cover bomb threats, hijacking, sabotage, and facility failure, and are tested through tabletop and live exercises.

Security awareness training is required for all airport staff with airside access, not only for screening personnel.

Supervisors must verify that screening positions are staffed, qualified, and rotated in accordance with fatigue and performance rules.

Reporting lines must ensure security-relevant information reaches the security manager and, where required, the appropriate authority without delay.

Access control layers are: perimeter, airside boundary, security-restricted area, and critical parts of restricted areas.

Identity and authorization checks require a valid airport identification card plus, where applicable, a personal identification document.

Electronic access control uses card, PIN, or biometric factors; cards must be revoked immediately on loss, theft, or termination.

The one-person-one-card rule prohibits tailgating and piggybacking; anti-passback logic detects credential sharing.

Perimeter protection combines physical barriers, intrusion detection, CCTV, lighting, and patrols; each layer compensates for the weaknesses of others.

Access points to restricted areas must be controlled, alarmed where unattended, and monitored from a staffed control room.

Vehicle access requires separate control, inspection, and escort procedures for vehicles entering the airside.

Screening of persons and items entering restricted areas is applied where the risk assessment identifies an insider or intrusion threat.

Screening sequence: document and boarding pass check, divesting, X-ray of cabin baggage, walk-through metal detection or body scanner, and resolution of alarms.

Divesting rules separate electronics, liquids, and metallic items; jackets and outer garments are screened separately.

Liquids, aerosols, and gels are subject to volume and container limits set in the national program; exceptions exist for essential medicines and baby food with verification.

Alarm resolution follows a defined escalation: re-screen, targeted search, and finally a full hand search of the item.

Hand search must be conducted in the passenger's presence with consent to the search of the item, and with a witness where required.

Prohibited items detected are handled under a documented procedure: refusal to surrender, police notification, and incident reporting.

Screening personnel must not accept gifts or favors from passengers and must avoid any conflict of interest in the screening decision.

Special categories (crew, diplomats, persons with reduced mobility) follow defined procedures but are never exempt from the security outcome.

Hold baggage must be protected from unauthorized interference from the point of screening to loading on the aircraft.

Reconciliation ensures each checked bag is matched to a passenger who has boarded; unattended or unidentified bags are not loaded.

Hold baggage screening uses EDS (explosive detection systems) or multi-view X-ray with a defined alarm resolution protocol.

Known consignor and regulated agent concepts allow cargo to be secured upstream, with the chain of custody documented.

Cargo screening methods include X-ray, explosive trace detection, physical search, and use of trained detection dogs.

Mail security requires screening of all mail carried on passenger and cargo aircraft, with procedures for suspicious items.

Chain-of-custody documentation must identify who screened the item, when, by what method, and the result.

Access to hold baggage and cargo storage areas is restricted and monitored; seals and tamper-evident devices are checked before loading.

X-ray image interpretation relies on density and atomic number: organic materials appear orange, inorganic/metals blue or black, and mixed materials green.

Multi-view and CT-based systems generate 3D images that reduce the need for manual search but require specific interpretation training.

Metal detectors are tested with a defined test piece before each shift and after any interruption; results are recorded.

EDS equipment must pass daily and periodic verification tests using approved test pieces; failures trigger removal from service.

Equipment maintenance is performed by qualified technicians under a maintenance schedule; operators record faults and do not use defective equipment.

Image interpretation training uses a library of threat and non-threat images with increasing complexity and time pressure.

Operator performance is monitored through threat image projection (TIP) and regular competency checks.

Radiation safety rules apply to X-ray equipment: no access to the beam, interlocks verified, and leakage surveys performed by qualified personnel.

Prohibited items are categorized as weapons, explosives, incendiaries, and other dangerous devices or substances defined in the national program.

Recognition relies on shape, density, component parts, and context, not on a single visual cue.

Improvised explosive devices may show batteries, wiring, switches, or unusual packing; any such combination is treated as a threat until resolved.

Disguised items (e.g., belt buckle knives, pen guns, concealed blades) require training on component-based recognition.

On detection, the operator must not touch or move a suspected explosive device; the area is cleared and the bomb squad is notified.

Items surrendered are documented and handed to the appropriate authority according to the national procedure.

Weapons detected on a passenger trigger police notification and an incident report; the passenger is not permitted to board with the item.

Prohibited item lists are updated by the appropriate authority and must be reflected in training materials and signage.

A lesson plan specifies objectives, prerequisites, content sequence, methods, materials, timing, and assessment criteria.

Learning objectives should be written with observable action verbs and measurable conditions (e.g., 'identify three prohibited items in a 30-second image').

Instructional methods include lecture, demonstration, guided practice, simulation, and on-the-job training, selected by objective type.

The demonstration–practice–feedback cycle is the core of psychomotor skills training such as hand search and image interpretation.

Questioning technique should use open questions to check understanding and closed questions to confirm facts.

Feedback must be specific, timely, and behavior-focused; it describes what was observed and what to change.

Presentation aids support, not replace, the instructor; each aid should serve a stated objective.

Instructor talk time should be balanced with learner activity; the ratio is set by the lesson design, not by habit.

Adult learners bring experience and expect relevance; instruction must connect to the job task and its consequences.

Knowles' andragogy principles: need to know, self-concept, prior experience, readiness to learn, orientation to problem-solving, and motivation.

Bloom's taxonomy levels (remember, understand, apply, analyze, evaluate, create) guide the choice of assessment method.

Assessment validity means the test measures the intended objective; reliability means consistent results across occasions and raters.

Formative assessment occurs during training to guide learning; summative assessment occurs at the end to certify competence.

A test blueprint maps each objective to items and weights, ensuring coverage and preventing over-sampling of easy topics.

Item quality checks include clarity, single correct answer, plausible distractors, and avoidance of cueing or trick wording.

Practical assessments use a checklist or rubric with defined critical (pass/fail) items and behavioral anchors.

A training needs analysis identifies the gap between required and current competence, and the tasks that justify training.

Task analysis breaks each job into tasks, sub-tasks, and required knowledge, skills, and attitudes, forming the basis of the curriculum.

The curriculum defines modules, hours, entry requirements, instructors, facilities, and assessment methods for each objective.

Initial training is followed by recurrent training at intervals set by the regulation, with content updated for new threats and equipment.

Competency-based programs define a minimum performance standard and do not advance learners who fail critical items.

Training records must capture trainee identity, content, date, instructor, result, and expiry of the qualification.

Instructor qualification includes subject competence, instructional technique, and assessed delivery before authorization.

Program evaluation uses Kirkpatrick levels: reaction, learning, behavior, and results, with data from tests and operational audits.

Instructor competency domains: subject knowledge, instructional design, delivery, assessment, and professional conduct.

Instructor evaluation includes classroom observation, learner feedback, and review of assessment decisions for consistency.

Inter-rater reliability is protected by calibration sessions in which instructors score the same performance and compare results.

Assessment decisions must be documented with the evidence observed and the standard applied, and be defensible on review.

Instructor recurrency requires periodic re-evaluation of both technical knowledge and instructional skills.

Evaluation data sources include test results, TIP detection rates, incident reports, and audit findings.

A non-conforming assessment (e.g., passing a learner who failed a critical item) is a reportable quality failure requiring corrective action.

Continuous improvement loop: collect data, identify gap, design intervention, implement, and re-measure.

Quality assurance of a training program covers content currency, instructor competence, facility suitability, and assessment integrity.

Internal audits of the training organization are scheduled at defined intervals and results are tracked to closure.

Key performance indicators include pass rate, first-attempt failure rate, TIP detection rate, and time-to-resolution of image alarms.

Trend analysis of test items identifies ambiguous or too-easy items, which are revised or retired.

Corrective action requires root-cause analysis, an owner, a deadline, and verification of effectiveness.

Changes to regulations, equipment, or threat level trigger a documented review of training content.

Learner complaints and appeals are handled under a defined procedure with records retained.

Management review uses audit, KPI, and feedback data to confirm the program remains fit for purpose.

Brazil's civil aviation security framework derives from Lei 7.565/1986 (Código Brasileiro de Aeronáutica), which authorizes the regulator to issue aviation security rules.

ANAC issues AVSEC requirements through RBAC (Regulamento Brasileiro da Aviação Civil) series regulations, notably RBAC 107 for airport and operator security programs and RBAC 108 for screening personnel certification.

The National Civil Aviation Security Program (PNAVSEC) is issued at the national level under the authority of the Comitê Nacional de Segurança da Aviação Civil (CONAVSEC); operator programs must be consistent with it.

Compliance chain: PNAVSEC → airport security program (PSA) → operator/company security program → local procedures and training records.

RBAC 108 governs certification and recurrent qualification of security screening personnel, including theoretical and practical examination requirements.

Oversight is executed through audits, inspections, and surveillance by ANAC; non-compliance can trigger sanctions under Lei 7.565/1986 and RBAC enforcement provisions.

Regulatory hierarchy: law → decree → RBAC regulation → resolution/instruction → approved security program → operational procedure.

Records of training, certification, and recurrency must be retained and made available to the regulator on request; retention periods are set in the applicable RBAC.

Annex 17 to the Chicago Convention contains Standards (binding, 'shall') and Recommended Practices ('should'); States notify differences to ICAO.

Annex 17 obliges each State to establish a National Civil Aviation Security Program, a national appropriate authority, and a national security committee.

Annex 17 requires each Contracting State to designate an appropriate authority and to ensure operators and airports have security programs approved by that authority.

Doc 8973 (Aviation Security Manual) is ICAO guidance, not a Standard; it explains how to implement Annex 17 provisions.

Annex 17 requires screening of passengers and cabin baggage, protection of hold baggage from unauthorized interference, and cargo/mail security controls.

The Convention on Offences and Certain Other Acts Committed on Board Aircraft (Tokyo 1963), Hague 1970, and Montreal 1971/1988 define the legal treatment of unlawful interference.

Annex 17 requires States to establish a process for sharing threat information and to conduct security risk assessments for their operations.

ICAO Universal Security Audit Programme (USAP) evaluates State implementation of Annex 17 Standards and the related Annex 9 and Annex 11 provisions.

Threat assessment combines intent, capability, and opportunity; risk = threat × vulnerability × consequence.

Threat levels are commonly expressed as low, medium, high, and critical, and drive corresponding increments in screening and patrol measures.

Sources of threat intelligence include national intelligence services, police, airport operators, airlines, and international partners via the appropriate authority.

Indicators of intent include hostile reconnaissance, unusual questioning, altered documents, and behavior inconsistent with the travel context.

Vulnerability analysis identifies gaps in access control, screening, and response capability that an adversary could exploit.

Consequence analysis weighs loss of life, aircraft damage, operational disruption, and reputational and economic impact.

A threat assessment is a living product: it must be reviewed when intelligence changes, when major infrastructure changes, and at defined intervals.

Risk treatment options are: avoid, reduce (mitigate), transfer, or accept; acceptance must be documented and approved at the appropriate level.

Unlawful interference includes unlawful seizure of aircraft, sabotage, hostage-taking, unlawful entry to airside areas, and introduction of weapons or dangerous devices.

The unlawful interference response cycle is: prevent, detect, respond, and recover, with notification obligations to the appropriate authority.

A security risk register records each identified risk with likelihood, impact, existing controls, residual rating, and an accountable owner.

The ALARP principle (as low as reasonably practicable) is applied when deciding whether further mitigation is justified.

Insider threat controls include vetting, background checks, segregation of duties, and monitoring of access to security-restricted areas.

A bomb threat or specific threat triggers predefined escalation, search, evacuation, and coordination procedures with police and the operator.

Post-incident activity includes preservation of evidence, reporting to the appropriate authority, and revision of the risk assessment.

Security risk management is iterative; controls are validated through drills, exercises, and audits rather than assumed effective.

Key roles: airport operator security manager, screening organization supervisor, airline security officer, and the State appropriate authority.

The Airport Security Committee coordinates security matters among the operator, airlines, police, and service providers and meets at defined intervals.

The security program defines restricted area boundaries, screening points, and the responsibilities of each entity operating at the airport.

Security responsibilities are documented in contracts and service-level agreements with ground handlers and concessionaires.

Contingency plans cover bomb threats, hijacking, sabotage, and facility failure, and are tested through tabletop and live exercises.

Security awareness training is required for all airport staff with airside access, not only for screening personnel.

Supervisors must verify that screening positions are staffed, qualified, and rotated in accordance with fatigue and performance rules.

Reporting lines must ensure security-relevant information reaches the security manager and, where required, the appropriate authority without delay.

Access control layers are: perimeter, airside boundary, security-restricted area, and critical parts of restricted areas.

Identity and authorization checks require a valid airport identification card plus, where applicable, a personal identification document.

Electronic access control uses card, PIN, or biometric factors; cards must be revoked immediately on loss, theft, or termination.

The one-person-one-card rule prohibits tailgating and piggybacking; anti-passback logic detects credential sharing.

Perimeter protection combines physical barriers, intrusion detection, CCTV, lighting, and patrols; each layer compensates for the weaknesses of others.

Access points to restricted areas must be controlled, alarmed where unattended, and monitored from a staffed control room.

Vehicle access requires separate control, inspection, and escort procedures for vehicles entering the airside.

Screening of persons and items entering restricted areas is applied where the risk assessment identifies an insider or intrusion threat.

Screening sequence: document and boarding pass check, divesting, X-ray of cabin baggage, walk-through metal detection or body scanner, and resolution of alarms.

Divesting rules separate electronics, liquids, and metallic items; jackets and outer garments are screened separately.

Liquids, aerosols, and gels are subject to volume and container limits set in the national program; exceptions exist for essential medicines and baby food with verification.

Alarm resolution follows a defined escalation: re-screen, targeted search, and finally a full hand search of the item.

Hand search must be conducted in the passenger's presence with consent to the search of the item, and with a witness where required.

Prohibited items detected are handled under a documented procedure: refusal to surrender, police notification, and incident reporting.

Screening personnel must not accept gifts or favors from passengers and must avoid any conflict of interest in the screening decision.

Special categories (crew, diplomats, persons with reduced mobility) follow defined procedures but are never exempt from the security outcome.

Hold baggage must be protected from unauthorized interference from the point of screening to loading on the aircraft.

Reconciliation ensures each checked bag is matched to a passenger who has boarded; unattended or unidentified bags are not loaded.

Hold baggage screening uses EDS (explosive detection systems) or multi-view X-ray with a defined alarm resolution protocol.

Known consignor and regulated agent concepts allow cargo to be secured upstream, with the chain of custody documented.

Cargo screening methods include X-ray, explosive trace detection, physical search, and use of trained detection dogs.

Mail security requires screening of all mail carried on passenger and cargo aircraft, with procedures for suspicious items.

Chain-of-custody documentation must identify who screened the item, when, by what method, and the result.

Access to hold baggage and cargo storage areas is restricted and monitored; seals and tamper-evident devices are checked before loading.

X-ray image interpretation relies on density and atomic number: organic materials appear orange, inorganic/metals blue or black, and mixed materials green.

Multi-view and CT-based systems generate 3D images that reduce the need for manual search but require specific interpretation training.

Metal detectors are tested with a defined test piece before each shift and after any interruption; results are recorded.

EDS equipment must pass daily and periodic verification tests using approved test pieces; failures trigger removal from service.

Equipment maintenance is performed by qualified technicians under a maintenance schedule; operators record faults and do not use defective equipment.

Image interpretation training uses a library of threat and non-threat images with increasing complexity and time pressure.

Operator performance is monitored through threat image projection (TIP) and regular competency checks.

Radiation safety rules apply to X-ray equipment: no access to the beam, interlocks verified, and leakage surveys performed by qualified personnel.

Prohibited items are categorized as weapons, explosives, incendiaries, and other dangerous devices or substances defined in the national program.

Recognition relies on shape, density, component parts, and context, not on a single visual cue.

Improvised explosive devices may show batteries, wiring, switches, or unusual packing; any such combination is treated as a threat until resolved.

Disguised items (e.g., belt buckle knives, pen guns, concealed blades) require training on component-based recognition.

On detection, the operator must not touch or move a suspected explosive device; the area is cleared and the bomb squad is notified.

Items surrendered are documented and handed to the appropriate authority according to the national procedure.

Weapons detected on a passenger trigger police notification and an incident report; the passenger is not permitted to board with the item.

Prohibited item lists are updated by the appropriate authority and must be reflected in training materials and signage.

A lesson plan specifies objectives, prerequisites, content sequence, methods, materials, timing, and assessment criteria.

Learning objectives should be written with observable action verbs and measurable conditions (e.g., 'identify three prohibited items in a 30-second image').

Instructional methods include lecture, demonstration, guided practice, simulation, and on-the-job training, selected by objective type.

The demonstration–practice–feedback cycle is the core of psychomotor skills training such as hand search and image interpretation.

Questioning technique should use open questions to check understanding and closed questions to confirm facts.

Feedback must be specific, timely, and behavior-focused; it describes what was observed and what to change.

Presentation aids support, not replace, the instructor; each aid should serve a stated objective.

Instructor talk time should be balanced with learner activity; the ratio is set by the lesson design, not by habit.

Adult learners bring experience and expect relevance; instruction must connect to the job task and its consequences.

Knowles' andragogy principles: need to know, self-concept, prior experience, readiness to learn, orientation to problem-solving, and motivation.

Bloom's taxonomy levels (remember, understand, apply, analyze, evaluate, create) guide the choice of assessment method.

Assessment validity means the test measures the intended objective; reliability means consistent results across occasions and raters.

Formative assessment occurs during training to guide learning; summative assessment occurs at the end to certify competence.

A test blueprint maps each objective to items and weights, ensuring coverage and preventing over-sampling of easy topics.

Item quality checks include clarity, single correct answer, plausible distractors, and avoidance of cueing or trick wording.

Practical assessments use a checklist or rubric with defined critical (pass/fail) items and behavioral anchors.

A training needs analysis identifies the gap between required and current competence, and the tasks that justify training.

Task analysis breaks each job into tasks, sub-tasks, and required knowledge, skills, and attitudes, forming the basis of the curriculum.

The curriculum defines modules, hours, entry requirements, instructors, facilities, and assessment methods for each objective.

Initial training is followed by recurrent training at intervals set by the regulation, with content updated for new threats and equipment.

Competency-based programs define a minimum performance standard and do not advance learners who fail critical items.

Training records must capture trainee identity, content, date, instructor, result, and expiry of the qualification.

Instructor qualification includes subject competence, instructional technique, and assessed delivery before authorization.

Program evaluation uses Kirkpatrick levels: reaction, learning, behavior, and results, with data from tests and operational audits.

Instructor competency domains: subject knowledge, instructional design, delivery, assessment, and professional conduct.

Instructor evaluation includes classroom observation, learner feedback, and review of assessment decisions for consistency.

Inter-rater reliability is protected by calibration sessions in which instructors score the same performance and compare results.

Assessment decisions must be documented with the evidence observed and the standard applied, and be defensible on review.

Instructor recurrency requires periodic re-evaluation of both technical knowledge and instructional skills.

Evaluation data sources include test results, TIP detection rates, incident reports, and audit findings.

A non-conforming assessment (e.g., passing a learner who failed a critical item) is a reportable quality failure requiring corrective action.

Continuous improvement loop: collect data, identify gap, design intervention, implement, and re-measure.

Quality assurance of a training program covers content currency, instructor competence, facility suitability, and assessment integrity.

Internal audits of the training organization are scheduled at defined intervals and results are tracked to closure.

Key performance indicators include pass rate, first-attempt failure rate, TIP detection rate, and time-to-resolution of image alarms.

Trend analysis of test items identifies ambiguous or too-easy items, which are revised or retired.

Corrective action requires root-cause analysis, an owner, a deadline, and verification of effectiveness.

Changes to regulations, equipment, or threat level trigger a documented review of training content.

Learner complaints and appeals are handled under a defined procedure with records retained.

Management review uses audit, KPI, and feedback data to confirm the program remains fit for purpose.